Skills & Agents

QA hiring toolkit: 5 skills (qa-jd-author, interview-question-author, hiring-rubric-author, calibration-guide-author, onboarding-plan-author) and 1 agent (interview-debrief-facilitator) covering the full hiring chain for QA / SDET / test-lead / quality-manager roles - job descriptions, ISTQB-aligned question banks, role-specific scoring rubrics, interviewer calibration per Levashina 2014 et al., post-interview debriefs, and 30-60-90 onboarding plans.

Test process + methodology: 19 skills + 7 agents covering risk-based testing, DoD, test strategy, blameless post-mortems, release readiness, smoke gating, pyramid analysis, TDD coaching, E2E budgets.

QA org chart of 15 sharply-scoped role agents across four tiers. Tier 1 IC: exploratory-charter-author, automation-harness-bootstrapper, load-test-plan-designer, security-test-plan-builder, a11y-manual-test-scripter, data-quality-engineer, production-tester. Tier 2 Lead: test-architect, test-effort-estimator, quality-coach, test-quality-coach. Tier 3 Manager: release-engineer, release-cutover-coordinator, qa-manager. Tier 4 Head/Director: head-of-quality. No generic persona-as-scope agents.

QA people-and-org toolkit for QA managers and heads of quality: 5 skills (career-ladder-author, exec-quality-narrative, performance-feedback-author, skill-matrix-author, tester-one-on-one-planner) and 1 agent (team-capability-gap-analyst). Covers team capability mapping per ISTQB CTAL-TM v3.0 Managing the Team, IC/management career ladders, GROW-model 1:1s, SBI evidence-based feedback, and Minto-pyramid executive quality narratives.

Test data engineering: 17 skills (bogus-data, boundary-value-generator, e2e-test-narrative-builder, factory-bot-data, faker-data, golden-file-conventions, malicious-payload-bank, mimesis-data, mountebank-imposters, msw-handlers, negative-test-generator, parameterized-test-generator, seed-data-curator, synthetic-data-toolkit, synthetic-pii-generator, test-data-patterns, wiremock-stubs) and 3 agents (golden-file-manager, mock-server-composer, test-data-setup-agent).

Test environment management: 4 skills (docker-compose-test, feature-flag-test-harness, playwright-fixture-builder, testcontainers) and 2 agents (db-snapshot-restore, test-environment-bootstrapper). Composes with parallel-isolation-checker in qa-flake-triage for shared-state diagnosis.

Test impact analysis + regression-suite hygiene: 2 skills (regression-suite-selector, coverage-debt-tracker) and 2 agents (test-suite-pruner, regression-suite-curator).

Test case management discipline (pre-execution authoring + lifecycle + traceability): 1 reference skill (test-case-anatomy-reference) + 5 platform case-management skills (testrail-case-management, xray-case-management, zephyr-scale-case-management, allure-testops-case-management, qase-io-case-management) + 1 build skill (traceability-matrix-builder) + 2 agents (test-case-quality-critic, tcm-migration-agent). Distinct from qa-test-reporting's *-integration skills (post-execution result sync); this is pre-execution case authoring + repository management.

Test reporting + coverage analytics: 15 skills - parsers (junit-xml-analysis, lcov-analysis, cobertura-analysis, allure-reports), build-an-X reporters (coverage-diff-reporter, test-run-summary-author), commercial integrations (extentreports, currents-integration, testrail-integration, xray-integration, zephyr-integration), per-language coverage analyzers (jest-coverage-analysis, jacoco-analysis, coverage-py-analysis), and unit-test-coverage-targeter - plus 2 agents (daily-test-suite-aggregator, release-quality-report-agent).

Test code reviewers for test files only — production code is out of scope. 5 skills (object-model-patterns, test-code-conventions, test-framework-blueprint, test-isolation-patterns, test-step-design-patterns) and 6 agents (assertion-quality-reviewer, e2e-selector-quality-critic, framework-architecture-auditor, mocking-anti-pattern-detector, test-code-critic, test-suite-health-auditor).

API testing: 8 skills (api-chaos-runner, api-testing-getting-started, karate-testing, postman-collections, restassured-testing, restler-fuzzing, schemathesis-fuzzing, tavern-testing) and 2 agents (api-test-author, api-test-tool-selector).

BDD pipelines: 10 skills (acceptance-test-from-criteria, bdd-getting-started, bdd-step-library-curator, behave-testing, cucumber-testing, gherkin-from-stories, living-documentation-publisher, manual-step-to-gherkin, reqnroll-testing, specflow-testing) and 2 agents (bdd-scenario-author, gherkin-style-reviewer).

Contract testing for microservices: 5 skills (contract-compatibility-gate, graphql-schema-regression, openapi-contract-diff, pact-contract-testing, protobuf-compat-checking) and 2 agents (contract-drift-investigator, contract-test-scaffolder).

Desktop application testing across Windows (WinAppDriver, Appium-Windows), macOS (XCTest UI, Apple Accessibility Inspector), Linux (AT-SPI), Electron (Playwright _electron API), and Qt (QtTest framework)

Embedded C/C++ testing: GoogleTest on ARM, ThrowTheSwitch Unity-C and Ceedling, gcov coverage, QEMU system emulation

Game engine testing (Unity, Unreal, Godot), platform certification overview (Sony TRC, Nintendo Lotcheck, MS XR, Steam Direct), multiplayer state machine coverage, and gameplay recording/replay

Mobile + mobile-web E2E testing: 11 skills covering xcuitest-suite, espresso-suite, appium-testing, detox-testing, maestro-flows, flutter-testing, mobile-device-matrix-toolkit, mobile-web-emulation-runner, touch-gesture-tester, mobile-perf-budget, mobile-a11y-test-author — plus 3 agents (mobile-driver-selector, mobile-test-author, mobile-test-scaffolder).

Mutation testing across languages: 5 skills (mull-mutation, mutmut-mutation, pitest-mutation, stryker-mutation, stryker-net-mutation) and 2 agents (mutation-survivor-explainer, mutation-tool-selector).

Property-based testing libraries: 5 skills covering Hypothesis (Python), fast-check (JS/TS), proptest (Rust), jqwik (JVM), and QuickCheck (Haskell) + ScalaCheck — each ships authoring + run + shrinking + CI integration — plus 3 agents (property-based-test-author, property-based-tool-selector, vacuous-property-critic).

Go + Rust unit testing per-framework wrappers: 5 skills (cargo-test, ginkgo-tests, go-rust-mocking, go-test, rstest-tests) and 2 agents (go-rust-framework-selector, go-rust-test-author).

JS/TS unit testing per-framework wrappers: 5 skills (ava-tests, jasmine-tests, jest-tests, mocha-tests, vitest-tests) and 1 agent (js-test-author). Per-framework lifecycle (configure / run / mock / coverage / CI). Does not duplicate qa-test-review test code hygiene.

JVM unit testing per-framework wrappers: 6 skills (assertj, junit5-tests, kotest-tests, scalatest, spock-tests, testng-tests) and 2 agents (jvm-framework-selector, jvm-test-author).

.NET unit testing per-framework wrappers: 4 skills (fluentassertions, mstest-tests, nunit-tests, xunit-tests) and 2 agents (dotnet-test-author, dotnet-test-framework-selector).

Python unit testing per-framework wrappers: 5 skills (doctest-tests, nose2-tests, pytest-asyncio-patterns, pytest-tests, unittest-tests) and 1 agent (python-test-author).

Web E2E framework wrappers: 10 skills (browserstack-automate, cypress-testing, lambdatest-automate, playwright-testing, puppeteer-testing, saucelabs-automate, selenium-testing, testcafe-testing, web-e2e-getting-started, webdriverio-testing) and 5 agents (cypress-codegen-reviewer, playwright-codegen-reviewer, selenium-grid-orchestrator, spec-to-e2e-test-scaffolder, web-e2e-framework-selector).

Atomic accessibility coverage: 13 skills (a11y-violation-gate, aria-authoring-patterns, axe-a11y, ibm-equal-access-a11y, lighthouse-a11y, pa11y-a11y, screen-reader-test-author, wave-a11y, wcag-checklist-builder, wcag-color-contrast, wcag-focus-trap, wcag-keyboard-navigation, wcag-compliance-reporter) and 2 agents (accessibility-code-critic, screen-reader-test-executor).

Firefox + Chrome extension lifecycle, MV2 to MV3 migration, host-permission prompts, and storage.sync vs storage.local test patterns

Chart + data viz testing: 3 skills (chartjs-snapshot-tests, d3-snapshot-tests, vega-spec-validator) and 1 agent (chart-test-author). Covers Canvas + SVG + declarative-spec visualizations, complementing qa-visual-regression which targets general UI screens.

Data quality testing for analytical pipelines: 5 skills (dbt-testing, great-expectations, soda-checks, data-quality-gate, data-quality-conventions) and 2 agents (schema-diff-reviewer, data-anomaly-triager).

Localization (l10n) + i18n testing: 4 skills (i18n-string-coverage, locale-format-validator, pseudo-localization-runner, rtl-rendering-tester) and 1 agent (l10n-audit-runner).

Modern web testing: 5 skills (browser-extension-tests, pwa-install-flow-tests, service-worker-tests, sw-cache-strategy-author, web-vitals-inp-deep) and 1 agent (modern-web-health-agent). Covers PWA + Chromium MV3 extensions + INP responsiveness.

PDF + print rendering tests: 4 skills (html-to-pdf-regression, pdf-accessibility-checker, pdf-snapshot-tester, print-stylesheet-tests) and 1 agent (pdf-test-author). Covers print/PDF output where qa-visual-regression covers screen output.

Workbox recipes, offline fallback patterns, Lighthouse PWA audit interpretation, and web-push subscription lifecycle testing — distinct from qa-modern-web's generic SW/install/cache-strategy skills and qa-notifications' cross-channel push harness

Visual regression testing: 8 skills (chromatic-visual-regression-testing, percy-visual-regression-testing, playwright-snapshots, responsive-breakpoint-runner, storybook-visual-regression-testing, visual-baseline-conventions, visual-baseline-gate, visual-diff-summarizer) and 3 agents (visual-baseline-curator, visual-ci-gate-orchestrator, visual-diff-classifier).

Compliance test patterns + readiness review: 8 skills (audit-trail-test-author, ccpa-test-patterns, compliance-evidence-generator, gdpr-test-patterns, hipaa-test-patterns, iso27001-test-patterns, pci-dss-scope-checker, soc2-evidence-collector) and 1 agent (compliance-readiness-reviewer). Covers regulated-industry test pattern catalogs.

DAST (dynamic application security testing): 6 skills (burp-headless, dast-baseline-runner, nightvision-dast, nuclei-dast, zap-authenticated-scans, zap-baseline) and 1 agent (dast-finding-triager). Sister to qa-sast for runtime vulnerabilities. Every scanner skill includes a mandatory False-positive triage section.

Structure-aware coverage-guided fuzzing: 3 reference skills (corpus-management-reference, sanitiser-integration-reference, crash-triage-reference) + 7 per-language fuzzer skills (libfuzzer-cpp, afl-plus-plus, go-native-fuzzing, cargo-fuzz-rust, atheris-python-fuzzing, jazzer-jvm-fuzzing, ossfuzz-integration) + 1 dispatcher skill (fuzz-toolkit-dispatcher) + 2 agents (fuzz-target-author, fuzz-findings-critic). Distinct from qa-property-based (hypothesis-driven + shrinking) and qa-api-testing/schemathesis-fuzzing (API-layer); this is binary/system-level coverage-guided fuzzing.

Infrastructure-as-code testing + security policy: 6 skills (checkov-policy, helm-chart-tester, kics-policy, policy-as-code-runner, tfsec-policy, trivy-config) and 2 agents (iac-policy-checker, terraform-plan-reviewer).

Tenant-isolation testing for B2B SaaS: row-level security, cross-tenant leak detection, tenant-id propagation tracing, isolation-model references (silo / pool / bridge), and adversarial review of tenant-leak risk.

SAST (static application security testing): 7 skills (bandit-python, codeql-queries, eslint-security-rules, gosec-go, pmd-apex-rules, semgrep-rules, sonarqube-rules) and 1 agent (sast-finding-triager). Every scanner skill includes a mandatory False-positive triage section.

SBOM generation + container image scanning + vuln prioritization: 7 skills (cyclonedx-format, grype-scanning, sbom-diff, spdx-format, syft-generation, trivy-image, vex-author) and 1 agent (vuln-prioritizer). Required for US EO 14028 + EU CRA + FDA medical-device guidance.

SCA (software composition analysis): 8 skills (bundle-audit-ruby, cargo-audit-rust, dependabot-config, npm-pip-maven-audit, osv-scanner, reachability-analyzer, renovate-config, snyk-test) and 1 agent (sca-prioritizer).

Secrets scanning + rotation: 5 skills (gitleaks-scanning, kingfisher-scanning, secrets-baseline-manager, secrets-rotation-runner, trufflehog-scanning) and 1 agent (secrets-finding-triager). Covers detection AND rotation workflow (git-history scrub doesn't fix the leak).

PII detection, masking, and synthetic data generation for test environments: 8 skills (data-masking-techniques-reference, faker-synthetic-data, k-anonymity-verifier, pii-categories-reference, pii-masking-pipeline-builder, presidio-pii-detection, synthea-healthcare-data, test-data-governance-reference) and 1 agent (pii-leak-critic).

Bug reproduction workflow: 1 skill (bug-report-template) and 9 agents (bug-report-from-recording, bug-repro-builder, crash-stack-trace-analyzer, defect-clusterer, defect-pipeline-runner, defect-trend-narrator, escape-defect-analyzer, failure-classifier, test-failure-debugger).

Chaos engineering + fault injection: 8 skills (chaos-experiment-author, chaos-mesh, chaos-results-reporter, failure-injection-test-author, gremlin-chaos, litmus-chaos, steady-state-hypothesis-validator, toxiproxy-chaos) and 1 agent (chaos-drill-orchestrator).

Defect management discipline (taxonomy, lifecycle, workflows): 3 reference skills (bug-lifecycle-reference, severity-vs-priority-reference, defect-taxonomy-istqb) + 4 platform-workflow skills (jira-bug-workflow-runner, linear-bug-workflow-runner, github-issues-bug-workflow, azuredevops-bug-workflow) + 1 build skill (bug-report-from-failure) + 4 agents (duplicate-defect-finder, bug-report-critic, ci-defect-filer, defect-fix-verifier). Distinct from qa-bug-repro which covers reproduction + clustering + trend narration; this covers triage workflow + taxonomy + severity classification, and closes the lifecycle with post-fix confirmation testing.

Flake triage: 4 skills (flake-dashboard-author, flake-pattern-reference, flake-remediation-guide, flaky-test-quarantine) and 5 agents (ai-flake-detector, e2e-flake-bisector, e2e-test-trend-reporter, parallel-isolation-checker, regression-bisector).

Load and performance testing: 12 skills (db-slow-query-detector, flame-graph-analyzer, gatling-load-testing, jmeter-load-testing, jvm-gc-tuning, k6-load-testing, latency-percentile-analyzer, lighthouse-budget-author, lighthouse-perf, load-testing-getting-started, locust-load-testing, perf-budget-gate) and 3 agents (load-test-tool-selector, perf-incident-responder, perf-regression-bisector).

Resilience drills: 6 skills (backup-verification-author, dr-drill-runner, error-budget-tests, mttr-mtbf-tracker, restore-time-tests, slo-negotiation-prep) and 2 agents (dr-drill-orchestrator, reliability-review-agent). Production-grade DR drills + backup verification + RTO + error-budget gating + incident metrics.

Shift-left QA: 4 skills (acceptance-criteria-extractor, bdd-suite-to-test-map, data-contract-extractor, nfr-extractor) and 4 agents (definition-of-done-checker, spec-to-suite-orchestrator, testability-reviewer, threat-model-from-spec).

Production-side QA per ISTQB-canonical shift right ("a test approach to test a system continuously in production"): 4 skills (feature-flag-experiment-validator, prod-canary-validator, rum-to-synthetic-gap-analyzer, synthetic-monitor-author) and 2 agents (canary-and-experiment-coordinator, observability-to-test).

Background job and queue testing: 8 skills (bullmq-tests, celery-tests, cron-job-test-author, idempotency-test-author, kafka-consumer-tests, rabbitmq-patterns, sidekiq-tests, sqs-patterns) and 1 agent (async-job-health-critic). Covers async job runners, queue patterns, scheduled jobs, and idempotency guarantees.

Cache testing across layers: Redis cache patterns, CDN cache-purge testing (Cloudflare, Fastly, CloudFront), Varnish VTC syntax, browser Cache-Control tests, cache-coherence + stampede + stale-while-revalidate references, and a cache-key collision detector. Covers RFC 9111 HTTP caching and the canonical multi-tier cache discipline (browser to CDN to app to data store).

Concurrency + race-condition testing: 6 skills (async-ordering-tests, deadlock-detection-harness, go-race-detector-workflow, jepsen-patterns, mvcc-isolation-tests, race-condition-test-author) and 1 agent (concurrency-critic). Code-level data races, distinct from qa-chaos (infrastructure fault injection).

Database migration testing: 4 skills (atlas-migrations, flyway-migrations, liquibase-migrations, sqlmesh-migrations) and 2 agents (db-migration-performance-critic, migration-blast-radius-reviewer). Covers schema-change safety, blast-radius review, and rollback verification across the major migration tools.

Distributed tracing assertion testing: 6 skills (jaeger-trace-tests, opentelemetry-trace-assertions, otel-collector-config-tester, tempo-trace-tests, trace-spec-author, zipkin-trace-tests) and 1 agent (trace-coverage-reviewer). Asserts on production trace shape (spans, attributes, parent links, status), not just on aggregate metrics.

Saga + CQRS + event sourcing test patterns: 5 skills (cqrs-projection-tests, event-sourcing-tests, eventual-consistency-tests, outbox-pattern-test-author, saga-transaction-tests) and 1 agent (saga-critic). Covers ACD-without-isolation saga tests, replay determinism, and projection consistency windows.

Serverless platform testing: AWS SAM Local, .NET Lambda Test Tools, Cloudflare Workers Miniflare, Vercel Edge Runtime, Netlify Functions, Serverless Framework, plus cold-start + timeout budget references and a serverless integration-test builder. Covers Lambda / Workers / Edge runtimes which have specific testing patterns (cold-start budgets, timeout testing, local emulators, edge-runtime divergence) absent from generic web-server test plugins.

Time-related testing: fake-clock libraries (libfaketime, sinon-fake-timers, jest-fake-timers, freezegun, timecop, mockclock), DST + leap-second references, ISO-8601 vs RFC 3339 reference, and a timezone test matrix builder. Covers time-based bugs (DST transitions, leap seconds, timezone arithmetic, clock skew) which are high-incident-rate but specific tooling is scattered.

Auth flow testing: 6 skills (auth0-tests, keycloak-tests, mfa-flow-test-author, oauth-flow-test-author, okta-tests, session-management-test-author) and 1 agent (token-storage-security-critic). Anchored on OAuth 2.0 / RFC 7636 PKCE / RFC 9700 / OWASP ASVS V3.

Experimentation harness testing: SDK-specific testing for Statsig, Optimizely, VWO, Amplitude Experiment; sample-ratio-mismatch (SRM) detection; AB-test validity checklist; guardrail-metrics + peeking-problem references. Distinct from qa-shift-right/feature-flag-experiment-validator (validates experiment results); this plugin tests the experimentation harness itself (SDK behaviour, assignment integrity, statistical-validity gates).

Feature-flag platform testing: SDK-specific tests for LaunchDarkly, Unleash, Flagsmith, GrowthBook; feature-flag test matrix reference; flag-state coverage builder; flag-removal runbook author; stale-flag detector. Distinct from qa-test-environment/feature-flag-test-harness (generic flag-aware test harness) and qa-shift-right/feature-flag-experiment-validator (validates experiment results); this plugin scopes to platform-SDK testing + flag-lifecycle hygiene.

GraphQL server testing: introspection attack-surface reference, persisted-query strategy, per-framework testing (Apollo Server, GraphQL Yoga, Hasura, Mercurius, Pothos), and an N+1 query detector. Distinct from qa-contract-testing/graphql-schema-regression (contract drift detection); this plugin covers server/runtime + framework-specific patterns.

gRPC testing tooling: buf-CLI lint and breaking-build, ghz load testing, grpcurl CLI, grpc-mock servers, protobuf versioning strategy reference, gRPC streaming test patterns, and status-code mapping reference. Distinct from qa-realtime-protocols/grpc-streaming-tests (wire-level streaming semantics) and qa-contract-testing/protobuf-compat-checking (schema-level breaking detection); this plugin scopes to tooling, load, linting, and framework-level testing.

Notifications + messaging testing across email/SMS/push/webhooks: 7 skills (email-flow-test-author, in-app-notification-test-author, mailhog-testing, mailpit-testing, push-notification-test-author, sms-test-author, webhook-delivery-tester) and 1 agent (notification-delivery-critic).

Payment platform sandbox testing: Stripe test cards + webhooks, Adyen test mode, PayPal sandbox, Braintree test cards; 3DS test flow + PCI DSS scope + payment flow states references; refund + chargeback + webhook-replay builders. Distinct from qa-compliance/pci-dss-scope-checker (compliance / scope verification); this plugin is platform-specific sandbox testing + payment flow state matrices.

Real-time protocol testing: 7 skills (grpc-streaming-tests, mqtt-tests, server-sent-events-tests, sse-load-test, stomp-amqp-tests, webhook-replay-tests, websocket-tests) and 1 agent (realtime-protocol-reviewer). Anchored on RFC 6455, WHATWG SSE, gRPC streaming, MQTT v5, and the Standard Webhooks signature scheme.

AI-assisted test generation + curation: 3 skills (ai-spec-coverage-mapper, ai-test-generator, model-based-test-graph-author) and 3 agents (ai-test-curator, ai-test-shallow-coverage-critic, mbt-suite-builder).

Jupyter notebook testing: 4 skills (nbval-tests, notebook-ci-pipeline-author, papermill-tests, testbook-tests) and 1 agent (notebook-quality-reviewer). Covers full-notebook regression (nbval), function-level unit tests (testbook), and parameterized execution (papermill).

LLM and prompt evaluation: 7 skills (deepeval-evaluation, giskard-llm, langfuse-tracing, llm-regression-suite-author, openai-evals, promptfoo-evaluation, ragas-evaluation) and 2 agents (llm-red-team-planner, prompt-eval-reviewer). Covers the mainstream OSS LLM-eval ecosystem: Promptfoo + OpenAI Evals + DeepEval + Ragas for functional eval, Giskard for adversarial scan, Langfuse for production observability.

ML model testing: 6 skills (alibi-explainability, deepchecks-tests, evidently-monitoring, fairlearn-fairness, giskard-tests, model-performance-regression-gate) and 2 agents (data-drift-incident-responder, model-fairness-reviewer). Covers vulnerability scanning, drift monitoring, group fairness, and per-prediction explainability.

Search relevance testing: 6 skills (elasticsearch-relevance-tests, hybrid-search-eval-author, judgment-list-author, opensearch-relevance-tests, solr-relevance-tests, vector-search-precision-tests) and 1 agent (relevance-regression-reviewer). IR-metrics-driven NDCG / MRR / Recall@k regression detection.

CI/CD test workflow patterns: 5 skills (ci-test-job-conventions, circleci-test-configs, github-actions-test-jobs, gitlab-ci-test-jobs, jenkinsfile-test-stages) and 1 agent (ci-pipeline-health-critic).

CLI + TUI testing tools: 4 skills (bats-testing, cli-output-conventions, pester-cli-testing, tui-snapshot-tester).

Production code quality: 5 skills (sonarqube-quality-perspective, codeclimate-config, lizard-complexity, madge-deps, knip-dead-code) and 1 agent (code-quality-critic). Production-only scope; test-code hygiene is owned by qa-test-review.

Browser + OS compatibility testing: 5 skills (browser-matrix-runner, browser-matrix-strategy-reference, compatibility-budget, os-matrix-runner, selenium-grid-4-runner) and 1 agent (compatibility-matrix-auditor).

Manual scripted + exploratory testing: 14 skills (bug-bash-facilitator, crusspic-stmpl-heuristic, decision-table-test-design, exploratory-tours-reference, fcc-cuts-vids-heuristic, hiccupps-f-heuristic, manual-test-debrief, manual-test-script-author, manual-testing-getting-started, sbtm-reference, sfdpot-heuristic, state-transition-test-design, test-execution-checklist, uat-script-author) and 3 agents (charter-coach, session-debrief-coach, test-script-quality-critic). Covers SBTM, Whittaker's seven tours, Bach + Bolton's heuristic catalogues (HICCUPPS-F oracles, SFDPOT variation, FCC CUTS VIDS modelling, CRUSSPIC STMPL quality criteria), UAT, bug bashes, and PROOF debriefs.